Questioning SCO: A Hard Look at Nebulous Claims

by Eben Moglen

Friday 1 August 2003

Users of free software around the world are being pressured to pay
The SCO Group, formerly Caldera, on the basis that SCO has
“intellectual property” claims against the Linux operating
system kernel or other free software that require users to buy a
“license” from SCO. Allegations apparently serious have
been made in an essentially unserious way: by press release,
unaccompanied by evidence that would permit serious judgment of the
factual basis for the claims. Firms that make significant use of free
software are trying to evaluate the factual and legal basis for the
demand. Failure to come forward with evidence of any infringement of
SCO's legal rights is suspicious in itself; SCO's public announcement
of a decision to pursue users, rather than the authors or distributors
of allegedly-infringing free software only increases doubts.

It is impossible to assess the weight of undisclosed evidence.
Based on the facts currently known, which are the facts SCO itself has
chosen to disclose, a number of very severe questions arise concerning
SCO's legal claims. As a lawyer with reasonably extensive experience
in free software licensing, I see substantial reason to reject SCO's
assertions. What follows isn't legal advice: firms must make their
own decisions based upon an assessment of their particular situations
through consultation with their own counsel. But I would like to
suggest some of the questions that clients and lawyers may want to ask
themselves in determining their response to SCO's licensing
demands.

Where's the Beef?

What does SCO actually claim belongs to it that someone else has
taken or is misusing? Though SCO talks about “intellectual
property,” this is a general term that needs specification. SCO
has not alleged in any lawsuit or public statement that it holds
patents that are being infringed. No trademark claims have been
asserted. In its currently-pending lawsuit against IBM, SCO makes
allegations of trade secret misappropriation, but it has not
threatened to bring such claims against users of the Linux OS kernel,
nor can it. It is undisputed that SCO has long distributed the Linux
OS kernel itself, under the Free Software Foundation's GNU General
Public License (GPL).[1] To claim that one has a
trade secret in any material which one is oneself fully publishing
under a license that permits unlimited copying and redistribution
fails two basic requirements of any trade secret claim: (1) that there
is a secret; and (2) that the plaintiff has taken reasonable measures
to maintain secrecy.

So SCO's claims against users of the Linux kernel cannot rest on
patent, trademark, or trade secret. They can only be copyright
claims. Indeed, SCO has recently asserted, in its first specific
public statement, that certain versions of the Linux OS kernel, the
2.4 “stable” and 2.5 “development” branches,
have since 2001 contained code copied from SCO's Sys V Unix in
violation of copyright.[2]

The usual course in copyright infringement disputes is to show the
distributor or distributors of the supposedly-infringing work the
copyrighted work upon which it infringes. SCO has not done so. It
has offered to show third parties, who have no interest in Linux
kernel copyrights, certain material under non-disclosure agreements.
SCO's press release of July 21 asserts that the code in recent
versions of the Linux kernel for symmetric multi-processing violates
their copyrights. Contributions of code to the Linux kernel are
matters of public record: SMP support in the kernel is predominantly
the work of frequent contributors to the kernel employed by Red Hat,
Inc. and Intel Corp. Yet SCO has not shown any of its code said to
have been copied by those programmers, nor has it brought claims of
infringement against their employers. Instead, SCO has demanded that
users take licenses. Which lead to the next question.

Why Do Users Need Licenses?

In general, users of copyrighted works do not need licenses. The
Copyright Act conveys to copyright holders certain exclusive rights in
their works. So far as software is concerned, the rights exclusively
granted to the holder are to copy, to modify or make derivative works,
and to distribute. Parties who wish to do any of the things that
copyright holders are exclusively entitled to do need permission; if
they don't have permission, they're infringing. But the Copyright Act
doesn't grant the copyright holder the exclusive right to use
the work; that would vitiate the basic idea of copyright. One doesn't
need a copyright license to read the newspaper, or to listen to
recorded music; therefore you can read the newspaper over someone's
shoulder or listen to music wafting on the summer breeze even though
you haven't paid the copyright holder. Software users are sometimes
confused by the prevailing tendency to present software products with
contracts under shrinkwrap; in order to use the software one has to
accept a contract from the manufacturer. But that's not because
copyright law requires such a license.

This is why lawsuits of the form that SCO appears to be
threatening—against users of copyrighted works for infringement
damages—do not actually happen. Imagine the literary equivalent
of SCO's current bluster: Publishing house A alleges that the
bestselling novel by Author X topping the charts from Publisher B
plagiarizes its own more obscure novel by Author Y.
“But,” the chairman of Publisher A announces at a news
conference, “we're not suing Author X or Publisher B; we're only
suing all the people who bought X's book. They have to pay us for a
license to read the book immediately, or we'll come after them.”
That doesn't happen, because that's not the law.

But don't users of free software make copies, and need a license
for that activity? The Copyright Act contains a special limitation on
the exclusive right to copy with respect to software. It does not
infringe the copyright holder's exclusive right to copy software for
the purpose of executing that software on one machine, or for purposes
of maintenance or archiving. Such copying also requires no license.
But what if a firm has gotten a single copy of the Linux kernel from
some source, and has made many hundreds or thousands of copies for
installation on multiple machines? Would it need a license for that
purpose? Yes, and it already has one.

Do Users Already Have a License?

The Linux kernel is a computer program that combines copyrighted
contributions from tens of thousands of individual programmers and
firms. It is published and distributed under the GPL, which gives
everyone everywhere permission to copy, modify and distribute the
code, so long as all distribution of modified and unmodified copies
occurs under the GPL and only the GPL. The GPL requires that everyone
receiving executable binaries of GPL'd programs must get the full
source code, or an offer for the full source code, and a copy of the
license. The GPL specifies that everyone receiving a copy of a GPL'd
program receives a license, on GPL terms, from every copyright holder
whose work is included in any combined or derived work released under
the license.

SCO, it bears repeating, has long distributed the Linux kernel
under GPL, and continues to do so as of this writing. It has directly
given users copies of the work and copies of the license. SCO cannot
argue that people who received a copyrighted work from SCO, with a
license allowing them to copy, modify and redistribute, are not
permitted to copy, modify and distribute. Those who have received the
work under one license from SCO are not required, under any theory, to
take another license simply because SCO wishes the license it has
already been using had different terms.

In response to this simple fact, some SCO officials have recently
argued that there is somehow a difference between their
“distribution” of the Linux kernel and
“contribution” of their copyrighted code to the kernel, if
there is any such code in the work. For this purpose they have quoted
section 0 of the GPL, which provides that “This License applies
to any program or other work which contains a notice placed by the
copyright holder saying it may be distributed under the terms of this
General Public License.” The Linux kernel contains such notices
in each and every appropriate place in the code; no one has ever
denied that the combined work is released under GPL. SCO, as Caldera,
has indeed contributed to the Linux kernel, and its contributions are
included in modules containing GPL notices. Section 0 of the GPL does
not provide SCO some exception to the general rule of the license; it
has distributed the Linux kernel under GPL, and it has granted to all
the right to copy, modify and distribute the copyrighted material the
kernel contains, to the extent that SCO holds such copyrights. SCO
cannot argue that its distribution is inadvertent: it has
intentionally and commercially distributed Linux for years. It has
benefited in its business from the copyrighted originality of tens of
thousands of other programmers, and it is now choosing to abuse the
trust of the community of which it long formed a part by claiming that
its own license doesn't mean what it says. When a copyright holder
says “You have one license from me, but I deny that license
applies; take another license at a higher price and I'll leave you
alone,” what reason is there to expect any better faith in the
observance of the second license than there was as to the first?

Conclusion

Users asked to take a license from SCO on the basis of alleged
copyright infringement by the distributors of the Linux kernel have a
right to ask some tough questions. First, what's the evidence of
infringement? What has been copied from SCO copyrighted work?
Second, why do I need a copyright license to use the work, regardless
of who holds copyright to each part of it? Third, didn't you
distribute this work yourself, under a license that allows everyone,
including me, to copy, modify and distribute freely? When I
downloaded a copy of the work from your FTP site, and you gave me the
source code and a copy of the GPL, do you mean that you weren't
licensing me all of that source code under GPL, to the extent that it
was yours to license? Asking those questions will help firms decide
how to evaluate SCO's demands. I hope we shall soon hear some
answers.

Footnotes

Linux kernel source under GPL was available from SCO's
FTP site as of July 21, 2003.